COPENHAGEN — Denmark is investigating a major security incident after unauthorized parties accessed personal information linked to about 8.8 million records in the country’s Central Person Register, including names, addresses and CPR identification numbers.
BREAKING: Hackers get personal info on 8.8 million people in Denmark government data leak, ministry says https://t.co/m4NJKJA7YZ
— Insider Paper (@TheInsiderPaper) October 5, 2026
The case is drawing national attention because CPR numbers are unique personal identifiers used across Danish public administration and many private services. Authorities say the incident was detected on October 2, 2026, but investigators traced suspicious activity back through September.
Officials have stressed that the incident does not currently appear to be a direct compromise of Denmark’s entire CPR database. Instead, unauthorized parties allegedly misused legitimate access held by a private Danish company permitted to search certain CPR information.
Unauthorized access involved automated CPR searches
Denmark’s Data Protection Agency said the incident involved a very large number of automated queries against the CPR system. Authorities believe the searches were apparently designed to identify valid CPR numbers.
The company whose access was misused had lawful permission to retrieve certain information from the register. That access has now been revoked while investigators examine how the activity occurred and whether additional safeguards are required.
Police are also involved in the investigation. Authorities have not publicly identified the company or the person or group responsible for the unauthorized searches.
Names, addresses and CPR numbers were accessed
The information involved includes names, addresses, CPR numbers and other details available through the company’s permitted access.
CPR numbers play a central role in Denmark’s identification system, but officials have not said that passwords, MitID credentials or payment-card information were obtained through the incident.
People registered with name-and-address protection received additional safeguards. According to the government’s initial findings, their protected names and addresses were not exposed through the unauthorized access.
8.8 Million Figure Includes More Than Current Residents
The 8.8 million figure does not mean that 8.8 million people currently living in Denmark were affected.
The Central Person Register contains roughly 11 million records, including current residents, people who have moved abroad and deceased individuals. The affected total therefore covers CPR records across several groups rather than only Denmark’s present population.
This distinction is important because the scale of the breach can otherwise appear larger than Denmark’s population without context.
Origin Energy Data Breach: 900,000 Customers Affected
Timeline of the Denmark data breach
Officials first detected irregular activity on the evening of October 2. A subsequent review found that unauthorized searches had taken place during September.
The CPR administration notified Denmark’s Data Protection Agency on October 4, and authorities announced the broader scope of the incident as their investigation developed.
Research, Education and Digital Affairs Minister Christina Egelund described the case as deeply serious. The government has informed the relevant parliamentary committee and ordered a wider security review of the CPR system.
The incident adds to growing concern over large-scale exposure of personal information. Similar risks were highlighted in Swikblog’s coverage of a UK cyberattack affecting millions of customer records and a separate cyberattack involving government systems in California.
Fraud and impersonation are the immediate concern
The biggest short-term risk is that criminals could use accurate personal information to make scam calls, emails or text messages appear legitimate.
A fraudster who already knows someone’s name, address or CPR number may be able to create a more convincing impersonation attempt. Authorities are therefore warning people not to assume a message is genuine simply because it contains correct personal details.
Denmark’s official Sikkerdigital guidance advises residents to avoid clicking unexpected links and never disclose MitID details, passwords, one-time codes or payment information to unsolicited callers or messages.
Residents can add a credit warning
People concerned about identity misuse can also place a credit warning on their CPR record through Borger.dk. The warning tells lenders and businesses to exercise extra caution before granting loans or credit in that person’s name.
Authorities have also expanded support through Denmark’s Cyberhotline for Digital Security, with extended opening hours announced as officials respond to public concern.
The investigation remains active. Authorities are still determining exactly who carried out the automated searches, how long the access was exploited and whether all affected information has been fully identified. Until those questions are answered, residents are being urged to remain alert for suspicious communications that use real personal details to establish trust.
Make Swikblog your go-to source on Google for reliable updates, smart insights, and daily trends.
